ALAS2023-2026-3183: Security update for 18 packages

ALAS2023-2026-3183, released November 7, 2026, fixes 6 CVEs across 18 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent

CVEs closed

2 rated Critical

Exploited

None reported

Highest CVSS

9.8

Base score, 0 to 10

Highest EPSS

0.0060

48th percentile

Priority of the 6 CVEs

Patch now 0
                                Urgent 2
                                High 2
                                Routine 2

Fixed package versions

Product	Release	Fixed in
bpftool	amzn 2023	1:6.1.188-233.393.amzn2023
bpftool-debuginfo	amzn 2023	1:6.1.188-233.393.amzn2023
kernel	amzn 2023	1:6.1.188-233.393.amzn2023
kernel-debuginfo	amzn 2023	1:6.1.188-233.393.amzn2023
kernel-debuginfo-common-aarch64	amzn 2023	1:6.1.188-233.393.amzn2023
kernel-debuginfo-common-x86_64	amzn 2023	1:6.1.188-233.393.amzn2023
kernel-devel	amzn 2023	1:6.1.188-233.393.amzn2023
kernel-headers	amzn 2023	1:6.1.188-233.393.amzn2023
kernel-livepatch-6.1.188-233.393	amzn 2023	1:1.0-0.amzn2023
kernel-modules-extra	amzn 2023	1:6.1.188-233.393.amzn2023
kernel-modules-extra-common	amzn 2023	1:6.1.188-233.393.amzn2023
kernel-tools	amzn 2023	1:6.1.188-233.393.amzn2023
kernel-tools-debuginfo	amzn 2023	1:6.1.188-233.393.amzn2023
kernel-tools-devel	amzn 2023	1:6.1.188-233.393.amzn2023
perf	amzn 2023	1:6.1.188-233.393.amzn2023
perf-debuginfo	amzn 2023	1:6.1.188-233.393.amzn2023
python3-perf	amzn 2023	1:6.1.188-233.393.amzn2023
python3-perf-debuginfo	amzn 2023	1:6.1.188-233.393.amzn2023

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Urgent	CVE-2026-89637	linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifs_che...	9.8	0.0060	None reported
Urgent	CVE-2026-89652	linux: In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS exp...	9.8	0.0051	None reported
High	CVE-2026-98096	ipv6: sr: restore network header before routing and forwarding	7.8	0.0051	None reported
High	CVE-2026-93125	bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max	7.8	0.0013	None reported
Routine	CVE-2026-98538	writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes	4.1	0.0022	None reported
Routine	CVE-2026-98775	nitro_enclaves: fix use-after-free on SLOT_ALLOC failure	6.5	0.0018	None reported

Also fixes CVE-2026-89637

ALAS2023-2026-3187
bpftool6.18, bpftool6.18-debuginfo, kernel-livepatch-6.18.51-120.162 and 16 more on amzn 2023
SUSE-SU-2026:5091-1
kernel-64kb, kernel-azure, kernel-default and 7 more on sles 15.7
ALAS2023-2026-3193
bpftool6.12, bpftool6.12-debuginfo, kernel-livepatch-6.12.111-136.204 and 15 more on amzn 2023
DEBIAN-CVE-2026-89637
linux on Debian 14

Vendor advisory

https://alas.aws.amazon.com/AL2023/ALAS-2026-3183.html

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/alas2023-2026-3183">ALAS2023-2026-3183 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.